Polymarket, the largest crypto prediction market by volume, halted trading and entered cancel-only mode on Thursday after a compromised third-party provider let an attacker drain roughly $2.65 million from user wallets. The incident was logged at 18:05 UTC on October 29, 2026, on the platform’s status page, which classified it as a major outage affecting the Predictions Trading API. The exchange froze new orders and paused relayer actions — the service that submits traders’ signed transactions to the blockchain — while engineers investigated what quickly became one of the most consequential security failures in the sector this year.
Cancel-only mode and a frozen relayer
Cancel-only mode is the trading floor’s emergency brake. Users can pull existing orders but cannot place new ones, and the relayer that normally submits signed transactions on their behalf is switched off. Polymarket’s first public statement framed the halt as an active investigation rather than a confirmed breach. “We’re still looking into this,” the platform posted on X. “The exchange is in cancel-only mode. You can cancel orders, but no new orders or trades are processing. Relayer actions are paused while we investigate.”
The wording matters. By pausing relayer actions alongside new orders, Polymarket cut off the mechanism an attacker would need to keep selling positions through the platform’s own infrastructure. The status page’s own notice — “Out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online” — confirmed that the freeze was defensive rather than a routine maintenance event. The incident was recorded at 18:05 UTC, and trading stayed down while the cause was isolated.
On-chain forensics: $2.65 million in a single wallet
Blockchain analytics firm Arkham identified a wallet it attributes to the suspected attacker holding about $2.65 million in POL, Polygon’s native token. The address, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, accumulated the funds through a series of recent USDC.e-to-POL swaps routed through Relay, and the assets were subsequently moved to other addresses. The on-chain trail is what turned scattered social-media reports of drained accounts into a measurable loss figure.
Those reports put a human scale on the exploit. A trader posting as CarOnPolymarket wrote: “If you are a Polymarket user, lock down your account. I just got drained $800,000.” The same user said a friend lost roughly $600,000 in the same incident and urged others not to interact with the site.
The two largest publicly reported victims — $800,000 and $600,000 — total $1.4 million, which is about 53% of the $2.65 million traced to the attacker wallet. That concentration suggests the exploit targeted a small number of high-balance accounts rather than sweeping the entire user base, a detail that helps explain how the loss happened quickly enough to trip the exchange’s emergency halt.
The third-party supply-chain vector
The root cause was not a breach of Polymarket’s core contracts but a compromise further up the supply chain. Security researchers at Hudson Rock said a script loaded from DebugBear, a web performance monitoring service, contained code that searched for a logged-in user’s trading session and attempted to sell their positions and transfer the assets. The firm reported that the same wallet address was hard-coded into the script as a fallback recipient.
That diagnosis aligns with Polymarket’s own statement. The platform said it had “identified & fixed” the issue and attributed it to a third party: “One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.” Supply-chain compromises are harder to defend against than direct hacks because the malicious code arrives through a vendor that already has legitimate access to the production environment. For users, the failure surfaced as a signature request or a silently sold position — actions that looked indistinguishable from normal trading until the balances were gone.
Polymarket’s response and the make-whole pledge
Polymarket’s public posture shifted from “still looking into this” to a definitive fix within hours. “We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement,” the company said on X, adding a commitment that will shape how the episode ends: “Anyone who has been impacted will be made whole.”
A make-whole pledge is a promise to compensate victims, and it is the clearest signal yet that Polymarket intends to absorb the loss rather than litigate over who bears responsibility for a vendor’s failure. The platform has referred wallets to law enforcement before — nearly 100 accounts in a July incident tied to $200 million in suspicious trades — but this time the referral concerns a theft, not trading activity.
A repeating pattern of third-party failures
This is not the first time a third party has been the weak link in Polymarket’s security. In June, the platform suffered a vendor breach that drained about $3 million and affected fewer than 15 accounts. Before that, a May compromise drained roughly $700,000 from an internal wallet. The October 29 incident is the third security event in roughly five months.
The arithmetic is worth stating plainly: the May, June and October incidents represent roughly $700,000, $3 million and $2.65 million respectively — about $6.35 million in cumulative losses across three events that all trace back to third-party access rather than a flaw in the prediction-market protocol itself. A single large loss is an incident; three in five months with the same class of root cause is a pattern, and it raises a direct question about how aggressively Polymarket is auditing the vendors it lets into its frontend.
What the exploit means for prediction markets
Prediction markets have spent 2026 pushing into mainstream finance — Polymarket launched perpetual trading with up to 20x leverage in September, and U.S. regulators have been mapping a path for the category onshore. A wallet-draining exploit that forces a trading halt is the kind of event that gives both users and regulators pause. The prompt response and make-whole pledge will limit the immediate damage, but the fact that a monitoring vendor’s script could reach into user sessions and sell positions will be studied by every other venue that relies on similar third-party tooling.
For now, the exchange remains in cancel-only mode while Polymarket completes its investigation and works to bring the platform back online. The company has not disclosed how many accounts were affected, how the vendor was compromised, or a timeline for full trading to resume. Until those details land, the lesson for users is unchanged: a prediction-market position is only as safe as the weakest third party plugged into the frontend that manages it.
Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.
